docs/chore: Phase 1 doc/code hygiene (code-review.md § Phase 1)

Removes ~30 stale "Phase N" / historical-staging comment references from
code and shell scripts now that v1.0 is done; fixes a stale dashboard
comment claiming applications/send-log were unimplemented; adds a CSRF ADR
to security.md documenting the Origin-check-over-tokens decision; resolves
docs/logo in roadmap.md (directory doesn't exist, criterion already met);
adds a gofmt -l check to CI so unformatted Go fails the build.

The known-limitations write-up for the log-tailer offset gap (the other
Phase 1 item) was already present in architecture.md § Log tailer, so no
change was needed there.

gofmt/go vet/go test clean on both Go modules (main + test/e2e), verified
on the dev server.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

internal/store/domains_test.go

@@ -62,8 +62,8 @@ func TestDeleteDomainCascadesApplications(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	// Insert an application + address directly (the AddApplication API lands in
-	// Phase 4); this verifies the ON DELETE CASCADE wiring now.
+	// Insert an application + address directly (bypassing the AddApplication
+	// API) to verify the ON DELETE CASCADE wiring.
 	now := time.Now().UTC().Format(time.RFC3339)
 	res, err := st.db.Exec(
 		"INSERT INTO applications (domain_id, login, address_mode, created_at) VALUES (?, ?, 'wildcard', ?)",

internal/store/sendlog_test.go

@@ -5,8 +5,8 @@ import (
 	"time"
 )
 
-// readSendLog returns every send_log row ordered by id. Phase 6 has no read
-// query yet (the monitoring UI is Phase 7), so tests read the table directly.
+// readSendLog returns every send_log row ordered by id. The monitoring UI has
+// no equivalent read query, so tests read the table directly.
 type sendLogRow struct {
 	QueueID  string
 	Domain   string